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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 
All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1 308. 

1 . This communication is responsive to 7/29/2008 . 

2. ^ The allowed claim(s) is/are 15-17. 20. 23-36 now renumbered as 1-18 . 

3. □ Acknowledgment is madeof a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b) □ Some* c) □ None of the: 

1 . □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-IUIONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1 . □ Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. 13 Information Disclosure Statements (PTO/SB/08), 

Paper No./Mail Date 4/28/2008 
4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application 

6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

7. M Examiner's Amendment/Comment 

8. □ Examiner's Statement of Reasons for Allowance 

9. □ Other . 



/Kenny S Lin/ 

Primary Examiner, Art Unit 2152 



Notice of Allowability 



Part of Paper No./Mail D 
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DETAILED ACTION 

1. Claims 15-17, 20, 23-36 are presented for examination. Claims 1-14, 18-19 and 21-22 
are canceled. 

2. The IDS submitted on 4/28/2008 are considered. 

EXAMINER'S AMENDMENT 

3. An examiner's amendment to the record appears below. Should the changes and/or 

additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1 .3 12. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Mathew Laskoski, Reg. No. 55,360, on September 18, 2008. 

4. The application has been amended as follows: 
1.-14. (Canceled) 

15. (Currently Amended) A method comprising: 
receiving network data; 

processing the network data at pne or more decoders to create input data for applying at 
least multi-dimensional content profiling; 



' 1 Deleted: a decoder chain ] 
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preventing, . ss through the network data, leaks of information by at least 

applying the multi-dimensional content profiling; and 

wherein the multi-dimensional content profiling comprises: 

loading one or more profiles, wherein the one or more profiles each comprise an 

expected set of statistical characteristics of data; 
continuously receiving the input data from rlic^i;A:^..;.:i...:5.^.L'...>.i^.j..i.Nji.:i; 
determining a probabilistic measure of membership of the input data relative to the 

one or more profiles; 
comparing the probabilistic measure with a threshold requirement for each of the 

one or more profiles; and 
preventing leaks of the information if t-he proLiabilistic measure meets the threshold 
rscpirfcmfctU 



16. (Original) The method of claim 15, wherein the information includes a digital asset. 

17. (Origiaal) The method of claim 15, whereta the multi-dimensional content profiling 
takes into account the stmcture of the information. 

18. (Canceled) 

19. (Canceled) 

20. (Currentiy Amended) A machine-readable storage medium having encoded 
information, which when read and executed by a machine causes a method comprising: 

receiving network data; 

processing the network data atpne or more decoders to create input data for applying at 
least multi-dimensional content profiling; 

preventing, through the network data, leaks of information by at least applying multi- 
dimensional content profiling; and 
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wherein the multi-dimensional content profiling comprises: 

loading one or more profiles, wherein the one or more profiles each comprise an 

expected set of statistical characteristics of data; 
continuously receiving the input data from the, n v v." ^,^^''>.>s, 
determining a probabilistic measure of membership of the input data relative to the 

one or more profiles; 
comparing the probabilistic measure with a threshold requirement for each of the 

one or more profiles; and 

requite. 11 tJt 



21. (Canceled) 

22. (Canceled) 



23. (Currentiy Amended) An apparatus comprising: 
a receiver to receive network data; 

a processor, coupled to the receiver, to prevent, through the network data, leaks of 
information by at least applying mLilti-dimensional content profiling, wherein the processor 
I processes the network data at,^:ji;j,;iJiliHA:.>J;.:i.;.:.]>..i:. t<> create input data for applying at least the 
multi-dimensional content profiling; 

the multi-dimensional content profiling comprising: 

loading one or more profiles, wherein the one or more profiles each comprise an 
expected set of statistical characteristics of data; 
I continuously receiving the input data from the jjne or more decoders : 

determining a probabilistic measure of membership of the input data relative to the 

one or more profiles; 
comparing the probabilistic measure with a threshold requirement for each of the 
one or more profiles; and 



i Deleted: a decoder di 
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' Deleted: generating a reactive measure if 
threshold requirement 

24. (Previously Presented) The method of claim 15, wherein processing the network data 
at the decoder chain comprises extracting data by removing one or more layers of content encoding 
selected from the group consisting of common compression, aggregation, file formats, encoding 
schemas, and combinations thereof. 



25. (Previously Presented) The method of claim 15, further comprising creating the 
profile by: 

loading positive training sets of documents; 

representing each document from the positive training sets of documents as a point in multi- 
dimensional space; 

separating the individual points in the multi-dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the positive training sets of documents; and 

converting the set of hyperplanes into the profile. 

26. (Previously Presented) The method of claim 25, further comprising creating the 

profile by: 

loading negative training sets of documents; 

representing each document from the negative training sets of documents as a point in 
multi-dimensional space; 

separating the individual points in the multi-dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the negative training sets of documents; and 

converting the set of hyperplanes into the profile. 
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27. (Previously Presented) The method of claim 15, wherein determining the 
probabilistic measure comprises updating one or more counters in a predetermined order, 
calculating values of output dimensions based on the one or more counters, and calculating an 
output score based on the output dimensions wherein the output score represents the probabilistic 

28. (Previously Presented) The method of claim 15, wherein the preventing operates in 
real-time. 

29. (Previously Presented) The method of claim 15, further comprising terminating 
sessions with leaks of information before the network data is fUly transferred. 

30. (Previously Presented) The method of claim 15, further comprising preventing, 
through the network data, leaks of information by also applying keyword scanning. 

31 . (Currently Amended) The machine -readable .storap;?. medium of claim 20, wherein 
the profile is created by: 

loading positive training sets of documents; 

representing each document from the positive training sets of documents as a point in multi- 
dimensional space; 

separating the individual points in tlie multi-dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the positive training sets of documents; and 

converting the set of hyperplanes into the profile. 

32. (Currently Amended) The machine -readable storage medium of claim 31, wherein 
the profile is created by: 

loading negative training sets of documents; 

representing each document from the negative training sets of documents as a point in 
multi-dimensional space; 
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separating the individual points in the multi-dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the negative training sets of documents; and 

converting the set of hyperplanes into the profile. 

I 33. (Currently Amended) The machiae-readableAtoKs^ medium of claim 20, further 

comprising receiving the network data at a decoder chain prior to implementing the multi- 
dimensional content profiling, whereta the decoder chain extracts data by removing one or more 
layers of content decoding selected from the group consisting of common compression, aggregation, 
file formats, encoding schemas, and combinations thereof. 

I 34. (Currentiy Amended) The machine -readable storage medium of claim 20, wherein 

the multi-dimensional content profiling further comprises establishing a connection with an alert 
module prior to sending the reactive measure. 

I 35. (Currentiy Amended) The machine -readable. stotiig;. medium of claim 20, wherein 

the calculating the set of output dimensions comprises determining one or more values for each 
counter and combining the one or more values for each counter to create the set of output 

dimensions. 

36. (Previously Presented) The apparatus of claim 23, wherein the calculating an output 
score is performed for each of the one or more profiles. 

Amendment to the specification (to overcome 101): 

Amending the page 74, line 15 paragraph starting with "The foregoing presentation. . ." with the 
following: 

A machine-readable medium may include encoded information, which when read and 
executed by a machine causes, for example, the described embodiments (e.g., one or more 
I described methods). The machine-readable medium may.include.niachine 
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I i! : c- iiuin 1 b n store programmable parameters and may also store information including 
executable instructions, non- programmable parameters, and/or other data. The machine -readable 

I S.UMt%S.inedium may comprise read-only memory (ROM), random-access memory (RAM), 
nonvolatile memory, an optical disk, a magnetic tape, and/or magnetic disk. The machine- 

I readable medium may further include - v. \. ^ ■ ■ \^ ^ , loi example, a carrier 

wave modulated, or otherwise manipulated, to convey instructions that can be read, 
demodulated/decoded and execute by the machine (e.g., a computer). The machine may 
comprise one or more microprocessors, microcontrollers, and/or other arrays of logic elements. 

Allowable Subject Matter 

5. Claims 15-17, 20, 23-36 are allowed. 

Conclusion 

6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kenny Lin whose telephone number is (571) 272-3968. The 
examiner can normally be reached on 8 AM to 5 PM Tue.-Fri. and every other Monday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Bunjob Jaroenchonwanit can be reached on (571) 272-3913. The fax phone number 
for the organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
apphcations is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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/Kenny S Lin/ 

Primary Examiner, Art Unit 2152 
September 24, 2008 



